Ensure RMT conforms with sles 16 immutability requirements

.github/workflows/lint-unit.yml

@@ -60,7 +60,7 @@ jobs:
 
       - name: Setup database config file
         run: |
-          sudo mkdir -p /var/lib/rmt
+          sudo mkdir -p /usr/share/rmt
           ruby -e "require 'yaml'; puts({'database_test'=>{'host' => '127.0.0.1', 'port' => 3306, 'username'=>'rmt','password'=>'rmt','database'=>'rmt_test','adapter'=>'mysql2','encoding'=>'utf8','timeout'=>5000,'pool'=>5}}.to_yaml)" > config/rmt.local.yml
 
       - name: Run Shell lint

DEVELOPMENT.md

@@ -45,10 +45,10 @@
 7. Copy the file `config/rmt.yml` to `config/rmt.local.yml`. With this file, override the following default settings:
     * Add your organization credentials to `scc` section.
     * Ensure that the `database` section is correct.
-8. Create the directory `/var/lib/rmt` and ensure that your current user owns it.
+8. Create the directory `/usr/share/rmt` and ensure that your current user owns it.
     ```
-    sudo mkdir /var/lib/rmt
-    sudo chown -R $(id -u):$(id -g) /var/lib/rmt
+    sudo mkdir /usr/share/rmt
+    sudo chown -R $(id -u):$(id -g) /usr/share/rmt
     ```
 9. Create the development database:
     ```

Dockerfile

@@ -17,13 +17,13 @@ COPY . /srv/www/rmt/
 RUN mkdir /srv/www/rmt/public/repo
 
 RUN ln -s /srv/www/rmt/bin/rmt-cli /usr/bin && \
-    mkdir /var/lib/rmt/ && \
+    mkdir /usr/share/rmt/ && \
     groupadd -r nginx && \
     useradd -g nginx -s /bin/false -r -c "user for RMT" _rmt && \
     chown _rmt /srv/www/rmt/public/repo && \
     chown _rmt /srv/www/rmt/public/suma
 
-RUN uuidgen > /var/lib/rmt/system_uuid
+RUN uuidgen > /usr/share/rmt/system_uuid
 
 EXPOSE 4224
 

MIGRATE.md

@@ -72,11 +72,11 @@ After this in order for the client machines to consume data from RMT, it would b
 
 ## Moving the mirrored repositories from SMT to RMT
 
-1. Copy data from `/var/www/htdocs/repo` to `/var/lib/rmt/public/repo`:
+1. Copy data from `/var/www/htdocs/repo` to `/usr/share/rmt/public/repo`:
     ```
-    cp -r /var/www/htdocs/repo/* /var/lib/rmt/public/repo
+    cp -r /var/www/htdocs/repo/* /usr/share/rmt/public/repo
     ```
 2. Adjust owner/group of the files to `_rmt:nginx`:
     ```
-    chown -R _rmt:nginx /var/lib/rmt/public/repo
+    chown -R _rmt:nginx /usr/share/rmt/public/repo
     ```

bin/compose-init.rb

@@ -5,10 +5,10 @@
   exit 1
 end
 
-# Create the `/var/lib/rmt/system_uuid` file if it does not exist already. This
+# Create the `/usr/share/rmt/system_uuid` file if it does not exist already. This
 # will ease up the first run of `rmt-cli` inside of this container.
-unless File.exist?('/var/lib/rmt/system_uuid')
-  system('dmidecode -s system-uuid > /var/lib/rmt/system_uuid')
+unless File.exist?('/usr/share/rmt/system_uuid')
+  system('dmidecode -s system-uuid > /usr/share/rmt/system_uuid')
 end
 
 # bundle if we have updates ready

ci/rmt-configure

@@ -36,9 +36,9 @@ if [ "$SCC_PASSWORD" = "" ] || [ "$SCC_USERNAME" = "" ]; then
 fi
 
 group "setup system uuid"
-  echo "saving uuid to /var/lib/rmt/system_uuid"
-  mkdir -p /var/lib/rmt/
-  echo "$SYSTEM_UUID" > /var/lib/rmt/system_uuid
+  echo "saving uuid to /usr/share/rmt/system_uuid"
+  mkdir -p /usr/share/rmt/
+  echo "$SYSTEM_UUID" > /usr/share/rmt/system_uuid
 groupend
 
 group "install rmt-server rpms"

docs/installation.md

@@ -85,5 +85,5 @@ After installation configure your RMT instance:
   in the official RMT documentation for information about `/etc/rmt.conf`.
 * Start RMT by running `systemctl start rmt-server`. This will start the RMT server at http://localhost:4224.
 * By default, mirrored repositories are saved under `/usr/share/rmt/public`, which is a symlink that points to
-`/var/lib/rmt/public`. In order to change destination directory, recreate `/usr/share/rmt/public` symlink to point to the
+`/usr/share/rmt/public`. In order to change destination directory, recreate `/usr/share/rmt/public` symlink to point to the
 desired location.

engines/instance_verification/config/environments/production.rb

@@ -1,7 +1,7 @@
 # :nocov:
 module InstanceVerification
   class Application < Rails::Application
-    config.cache_config_file = '/var/lib/rmt/rmt-cache-trim.sh'
+    config.cache_config_file = '/usr/share/rmt/rmt-cache-trim.sh'
     repo_cache_base_dir = 'tmp/cache/repository'
     config.repo_payg_cache_dir = Rails.root.join("#{repo_cache_base_dir}/payg")
     config.repo_byos_cache_dir = Rails.root.join("#{repo_cache_base_dir}/byos")

engines/registration_sharing/README.md

@@ -21,7 +21,7 @@ regsharing:
 * `peers` -- list of hostnames/IP addresses, to which registration data will be shared;
 * `api_secret` -- shared API secret;
 * `smt_allowed_ips` -- list of IPs from which regsharing requests are accepted that use legacy SMT regsharing API;
-* `data_dir` (optional) -- directory for persisting shared data state, `/var/lib/rmt/regsharing` is used if not set;
+* `data_dir` (optional) -- directory for persisting shared data state, `/usr/share/rmt/regsharing` is used if not set;
 * `ca_path` (optional) -- path to CA trust store (for peer certificates that aren't trusted by CAs in the system-wide trust store). 
 
 ## Rake tasks

engines/registration_sharing/lib/registration_sharing.rb

@@ -3,7 +3,7 @@
 require 'registration_sharing/engine'
 
 module RegistrationSharing
-  RMT_REGSHARING_DEFAULT_DATA_DIR = '/var/lib/rmt/regsharing'.freeze
+  RMT_REGSHARING_DEFAULT_DATA_DIR = '/usr/share/rmt/regsharing'.freeze
 
   class << self
     # creates a file on the disk to mark systems with changed registration data

engines/registration_sharing/package/rmt-server-trim-cache.service

@@ -7,7 +7,7 @@ Wants=rmt-server.service
 Type=oneshot
 Restart=no
 Environment="LOG_TO_JOURNALD=1" "LANG=en"
-EnvironmentFile=/var/lib/rmt/rmt-cache-trim.sh
+EnvironmentFile=/usr/share/rmt/rmt-cache-trim.sh
 ExecStart=find ${REPOSITORY_CLIENT_PAYG_CACHE_DIRECTORY} -mmin +${REPOSITORY_PAYG_CACHE_EXPIRY_MINUTES} -type f -delete
 ExecStart=find ${REPOSITORY_CLIENT_BYOS_CACHE_DIRECTORY} -mmin +${REPOSITORY_BYOS_CACHE_EXPIRY_MINUTES} -type f -delete
 ExecStart=find ${REPOSITORY_CLIENT_HYBRID_CACHE_DIRECTORY} -mmin +${REPOSITORY_HYBRID_CACHE_EXPIRY_MINUTES} -type f -delete

engines/zypper_auth/lib/zypper_auth/engine.rb

@@ -1,7 +1,7 @@
 module ZypperAuth
   class << self
     def auth_logger
-      Thread.current[:logger] ||= ::Logger.new('/var/lib/rmt/zypper_auth.log')
+      Thread.current[:logger] ||= ::Logger.new('/usr/share/rmt/zypper_auth.log')
       Thread.current[:logger].reopen
       Thread.current[:logger]
     end

features/mirror_spec.rb

@@ -1,5 +1,5 @@
 describe 'mirror' do
-  let(:path) { '/var/lib/rmt/public/repo/SUSE/Products/SLE-Product-SLES/15-SP5/x86_64' }
+  let(:path) { '/usr/share/rmt/public/repo/SUSE/Products/SLE-Product-SLES/15-SP5/x86_64' }
 
   before do
     `/usr/bin/rmt-cli repos enable 5664`
@@ -37,7 +37,7 @@
 end
 
 describe 'mirror multiple times' do
-  let(:path) { '/var/lib/rmt/public/repo/SUSE/Products/SLE-Product-SLES/15-SP5/x86_64/product' }
+  let(:path) { '/usr/share/rmt/public/repo/SUSE/Products/SLE-Product-SLES/15-SP5/x86_64/product' }
 
   before do
     `/usr/bin/rmt-cli repos enable 5664`

lib/suse/connect/api.rb

@@ -29,7 +29,7 @@ def connect_api
         uri_string.freeze
       end
 
-      UUID_FILE_LOCATION = '/var/lib/rmt/system_uuid'.freeze
+      UUID_FILE_LOCATION = '/usr/share/rmt/system_uuid'.freeze
 
       # Amount of systems per update request
       BULK_SYSTEM_REQUEST_LIMIT = 50

package/obs/rmt-server.spec

@@ -24,10 +24,16 @@
 %define rmt_user     _rmt
 %define rmt_group    nginx
 
-# Only build for the distribution default Ruby version
+# SLE 15 SP7 and newer (including 16.0/Factory) support Ruby 3.4
+%if 0%{?sle_version} && 0%{?sle_version} >= 150700
+%define rb_build_versions     ruby34
+%define rb_build_ruby_abis    ruby:3.4.0
+%define ruby_version          ruby3.4
+%else
 %define rb_build_versions     %{rb_default_ruby}
 %define rb_build_ruby_abis    %{rb_default_ruby_abi}
 %define ruby_version          %{rb_default_ruby_suffix}
+%endif
 
 # disabling dwz for now, as it is not available in SLE15
 # related bugzilla https://bugzilla.suse.com/show_bug.cgi?id=1180984
@@ -44,6 +50,7 @@ Source0:        %{name}-%{version}.tar.bz2
 Source1:        rmt-server-rpmlintrc
 Source2:        rmt.conf
 Source3:        rmt-cli.8.gz
+Source4:        rmt-tmpfiles.conf
 BuildRequires:  %{ruby_version}
 BuildRequires:  %{ruby_version}-devel
 BuildRequires:  chrpath
@@ -114,31 +121,33 @@ cp -p %{SOURCE2} .
 
 %setup -q
 sed -i '1 s|/usr/bin/env\ ruby|/usr/bin/ruby.%{ruby_version}|' bin/*
+
 # Set the version of bundler available within the build environment instead
 # of expect a hardcoded version. This ensures we bundle with the available version of bundler no matter which version available
 # NOTE: This relies on the fact that the lock file format does not change between bundler versions (which is not yet the case)
-sed -i "s/2\.2\.34/$(bundle.%{ruby_version} --version | grep -oE '([0-9]+\.?){3}')/g" Gemfile.lock
+sed -i "s/BUNDLED WITH/BUNDLED WITH/g; /BUNDLED WITH/{n; s/[0-9.]\+/$(bundle.%{ruby_version} --version | grep -oE '([0-9]+\.?){3}')/}" Gemfile.lock
 
 %build
 bundle.%{ruby_version} config build.nio4r --with-cflags='%{optflags} -Wno-return-type'
 bundle.%{ruby_version} config set deployment 'true'
 bundle.%{ruby_version} config set without 'test development'
-bundle.%{ruby_version} install %{?jobs:--jobs %{jobs}}
+bundle.%{ruby_version} install --local %{?jobs:--jobs %{jobs}}
 
 %install
-mkdir -p %{buildroot}%{data_dir}
 mkdir -p %{buildroot}%{lib_dir}
 mkdir -p %{buildroot}%{app_dir}
 mkdir -p %{buildroot}%{conf_dir}/ssl
-mkdir -p %{buildroot}%{data_dir}/regsharing
+mkdir -p %{buildroot}%{app_dir}/regsharing
 
-mv tmp %{buildroot}%{data_dir}
-mkdir %{buildroot}%{data_dir}/public
-mv public/repo %{buildroot}%{data_dir}/public/
-mv public/suma %{buildroot}%{data_dir}/public/
+mv tmp %{buildroot}%{app_dir}
+mkdir -p %{buildroot}%{app_dir}/public
+mv public/repo %{buildroot}%{app_dir}/public/
+mv public/suma %{buildroot}%{app_dir}/public/
 mv vendor %{buildroot}%{lib_dir}
 
 cp -ar . %{buildroot}%{app_dir}
+ln -s %{data_dir}/public/repo %{buildroot}%{app_dir}/public/repo
+ln -s %{data_dir}/public/suma %{buildroot}%{app_dir}/public/suma
 ln -s %{data_dir}/tmp %{buildroot}%{app_dir}/tmp
 mkdir -p %{buildroot}%{_bindir}
 ln -s %{app_dir}/bin/rmt-cli %{buildroot}%{_bindir}
@@ -211,16 +220,16 @@ install -D -m 644 package/files/rmt-cli_bash-completion.sh %{buildroot}%{_datadi
 
 install -D -m 644 package/files/rmt-server.reg %{buildroot}%{_sysconfdir}/slp.reg.d/rmt-server.reg
 
+install -D -m 644 %{SOURCE4} %{buildroot}%{_tmpfilesdir}/rmt.conf
+
 # cleanup of /usr/bin/env commands
 grep -rl '\/usr\/bin\/env ruby' %{buildroot}%{lib_dir}/vendor/bundle/ruby | xargs \
     sed -i -e 's@\/usr\/bin\/env ruby.%{ruby_version}@\/usr\/bin\/ruby\.%{ruby_version}@g' \
     -e 's@\/usr\/bin\/env ruby@\/usr\/bin\/ruby\.%{ruby_version}@g'
 grep -rl '\/usr\/bin\/env bash' %{buildroot}%{lib_dir}/vendor/bundle/ruby | xargs \
     sed -i -e 's@\/usr\/bin\/env bash@\/bin\/bash@g'
-
-# Drop 'BUNDLED WITH' line from Gemfile.lock. It causes trouble when the Gemfile.lock
-# was created with a different major version than the distribution's bundler.
-sed -i '/BUNDLED WITH/{N;d;}' %{buildroot}%{app_dir}/Gemfile.lock
+# Patch minitest shebang specifically for its non-standard env usage
+sed -i 's@/usr/bin/env -S ruby@/usr/bin/ruby.%{ruby_version}@g' %{buildroot}%{lib_dir}/vendor/bundle/ruby/3.4.0/gems/minitest-6.0.2/lib/minitest/complete.rb
 
 # Drop warning "Nokogiri was built against libxml version x, but has dynamically y"
 # Because we cannot control which libxml version is installed on the system
@@ -229,7 +238,6 @@ sed -i 's|warnings << "Nokogiri was built|# warnings << "Nokogiri was built|' %{
 # cleanup unneeded files
 find %{buildroot}%{lib_dir} "(" -name "*.c" -o -name "*.h" -o -name .keep ")" -delete
 find %{buildroot}%{app_dir} -name .keep -delete
-find %{buildroot}%{data_dir} -name .keep -delete
 rm -r  %{buildroot}%{lib_dir}/vendor/bundle/ruby/[23].*.0/cache
 rm -rf %{buildroot}%{lib_dir}/vendor/cache
 rm -rf %{buildroot}%{lib_dir}/vendor/bundle/ruby/*/gems/*/doc
@@ -256,15 +264,19 @@ chrpath -d %{buildroot}%{lib_dir}/vendor/bundle/ruby/*/extensions/*/*/mysql2-*/m
 %attr(0755,root,root) %{app_dir}/public/tools
 %exclude %{app_dir}/engines/
 %exclude %{app_dir}/package/
-%exclude %{app_dir}/rmt/tmp
-%attr(-,%{rmt_user},%{rmt_group}) %{data_dir}
+%exclude %{app_dir}/tmp
+%ghost %attr(-,%{rmt_user},%{rmt_group}) %{data_dir}
+%attr(-,%{rmt_user},%{rmt_group}) %{app_dir}/public/repo
+%attr(-,%{rmt_user},%{rmt_group}) %{app_dir}/public/suma
 %attr(-,%{rmt_user},%{rmt_group}) %{conf_dir}
 %dir %{_libexecdir}/supportconfig
 %dir %{_libexecdir}/supportconfig/plugins
 %dir %{script_dir}
-%dir /var/lib/rmt
-%ghost %{_datadir}/rmt/public/repo
-%ghost %{_datadir}/rmt/public/suma
+%ghost %dir /var/lib/rmt
+%dir %{_datadir}/rmt
+%{_tmpfilesdir}/rmt.conf
+%{app_dir}/public/repo
+%{app_dir}/public/suma
 
 # The secrets file is created by running the initial rake tasks in the `post` section
 %ghost %attr(0640,root,%{rmt_group}) %{app_dir}/config/secrets.yml.key
@@ -318,7 +330,7 @@ chrpath -d %{buildroot}%{lib_dir}/vendor/bundle/ruby/*/extensions/*/*/mysql2-*/m
 %{_bindir}/rmt-manual-instance-verify
 %attr(-,root,root) %{app_dir}/engines/
 %dir %{_sysconfdir}/nginx/rmt-auth.d/
-%dir %attr(-,%{rmt_user},%{rmt_group}) %{data_dir}/regsharing
+%ghost %dir %attr(-,%{rmt_user},%{rmt_group}) %{app_dir}/regsharing
 %exclude %{app_dir}/engines/registration_sharing/package/
 %dir %{_sysconfdir}/nginx
 %dir %{_sysconfdir}/nginx/vhosts.d
@@ -345,6 +357,7 @@ getent passwd %{rmt_user} >/dev/null || \
 
 %post
 %service_add_post rmt-server.target rmt-server.service rmt-server-migration.service rmt-server-mirror.service rmt-server-sync.service rmt-server-systems-scc-sync.service rmt-uptime-cleanup.service
+%tmpfiles_create rmt.conf
 
 # Run only on install
 if [ $1 -eq 1 ]; then
@@ -357,9 +370,6 @@ if [ $1 -eq 2 ]; then
     mv %{app_dir}/ssl/* %{conf_dir}/ssl
     echo "RMT SSL configuration has been moved to a new location: %{conf_dir}/ssl"
   fi
-  if [ -f %{app_dir}/config/system_uuid ]; then
-    mv %{app_dir}/config/system_uuid /var/lib/rmt/system_uuid
-  fi
   bash %{script_dir}/update_rmt_app_dir_permissions.sh %{app_dir}
 
   echo "RMT database migration in progress. This could take some time."
@@ -368,14 +378,6 @@ if [ $1 -eq 2 ]; then
   echo "  systemctl status rmt-server-migration.service"
 fi
 
-if [ ! -e %{_datadir}/rmt/public/repo ]; then
- ln -ns %{_sharedstatedir}/rmt/public/repo %{_datadir}/rmt/public/repo
-fi
-
-if [ ! -e %{_datadir}/rmt/public/suma ]; then
- ln -ns %{_sharedstatedir}/rmt/public/suma %{_datadir}/rmt/public/suma
-fi
-
 %preun
 %service_del_preun rmt-server.target rmt-server.service rmt-server-migration.service rmt-server-mirror.service rmt-server-sync.service rmt-server-systems-scc-sync.service rmt-uptime-cleanup.service
 

package/obs/rmt-tmpfiles.conf

@@ -0,0 +1,6 @@
+d /var/lib/rmt 0750 _rmt nginx -
+d /var/lib/rmt/regsharing 0750 _rmt nginx -
+d /var/lib/rmt/tmp 0750 _rmt nginx -
+d /var/lib/rmt/public 0755 _rmt nginx -
+d /var/lib/rmt/public/repo 0755 _rmt nginx -
+d /var/lib/rmt/public/suma 0755 _rmt nginx -